Vulnerability Report: GO-2024-3306

CVE-2024-53257, GHSA-7mwh-q3xm-qh6p
Affects: vitess.io/vitess
Published: Dec 12, 2024

Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess

For detailed information about this vulnerability, visit https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p.

Affected Packages

Path

Go Versions

Custom Versions^*

Symbols
vitess.io/vitess/go/vt/vtgate

before v0.19.8, from v0.20.0 before v0.20.4, from v0.21.0 before v0.21.1

before 19.0.8, from 20.0.0 before 20.0.4, from 21.0.0 before 21.0.1

all symbols
vitess.io/vitess/go/vt/vttablet/tabletserver

before v0.19.8, from v0.20.0 before v0.20.4, from v0.21.0 before v0.21.1

before 19.0.8, from 20.0.0 before 20.0.4, from 21.0.0 before 21.0.1

all symbols

^{*Custom versions, which can't be mapped automatically to standard Go module versions, are ignored by govulncheck. (See this note on versions for more details.)}

Aliases

References

Feedback

See anything missing or incorrect? Suggest an edit to this report.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL